Posted
by
CmdrTaco
on Monday February 07, 2011 @12:18PM
from the believe-it-when-you-see-it dept.

Gunkerty Jeb writes "The days of wondering whether those drunken sex party photos are indeed the Olsen Twins, or if they are just the Mary-Kate and Ashley's faces photo-shopped on the bodies of Lindsay Lohan and Amy Winehouse are OVER! A group of academic researchers at the University of Cambridge has developed a new technique for making JPEG images copy-evident, so that users can tell whether an image has been recompressed and copied."

If the image can't be re-encoded or re-scaled without the watermark becoming visible, then it probably can't be resized for viewing either. So the only images can can really make use of this 'tech' are the ones that are already shrunk to their smallest desirable viewing size. I'm not sure how much use this will really have.

The only images you're going to want to protect are the ones you've distributed on the web.* Those are going to be the ones that are already scaled down. You do scale down your images before you host them, right?

*if you've decided to be a dick about copying, you're probably not going to be distributing your high res source image

Of course. Everyone posting their copyrighted images to Flickr, Tumblr, and other sites missing vowels always resize their images first, including making their own thumbnails. No one relies on the site to make its own thumbnails or show the image at various sizes.

If you're using a remote app to resize your files, then the remote app can apply this filter at the same time. No big deal. The point is that there's no reason for the end user to have the source file, especially if you're only delivering a low res copy of it.

If somebody is copying it for a "friendly" reason, why not use a link? If they can't embed a link, then they can have a watermark. Still not good enough? Well how about asking? That's not being a dick. That's preventing others from being dicks.

If you take a photo of Prince William with some other woman kissing. You would send not a low res image to a newspaper you would send a small cropped edited one with this invisible water mark. If the Paper wants to use it they would need to ask you for the image in the given size. If they try to edit that they see the water mark and can't print/put to the web.When they do post this image to the web with out altering it, and you see that Huffington post has this photo, you copy image to your desktop, open it

You don't distribute the RAW, just process it. Send only small (not suitable for print) and/or watermarked images until you have the licensing fee in hand if you're trying to get money for the photos. Once they pay, they get a full-res, non-watermarked jpeg. You know, exactly like how stock photo sites work - at least from the buyer's perspective.

If you read the article, they are depending on the JPEG compression artifacts for the watermark display. Resizing should not cause this because you are deling with the uncompressed image data.

Resizing and then saving as a JPEG will result in re-compression and the watermark appearing. Saving as anything else bypasses this completely.

This is only useful when you know what conditions will be applied. The example they give near the end, uploading to youtube, will apply only as long as youtube does not change their settings. Then you have to change your thresholds and all of your protected videos in the wold are unprotected.

Actually, after playing with it a little bit, it becomes readily apparent that resizing (at least in Opera) affects this the exact same way that re-compressing the data as a jpeg does. As I run through the compression qualities in paint.net, I see the exact same patterns of compression artifacts in the images that I do when scrolling through zoom levels in my browser. Really, image scaling and compression are very similar problems, so this shouldn't surprise anyone.

my guess is if you upsample the image by a large amount, then blur it at the upsampled size, then sownsample again you will strip the signal out. high frequency signals like that are going to be rather fragile because they have to hide in a complessed image and there isn't much excess data space to hide in with a compressed image

The original image can be resized without showing the watermark, see their demo page [cam.ac.uk] (and press Ctrl +/- if you browse with Firefox). But so can the re-encoded picture, it shows the watermark only at the zoom level of 100%.

From this I suppose that there is also one zoom level at which the original picture shows the VOID watermark (you better choose it to be an odd value)!

I'm not sure what the method in TFA does since I didn't read it, but this isn't cold fusion.

Watermarking has been available for a while, even as a standard Photoshop filter. Just for a test, I applied the Digimarc watermark to a 18MP shot of my dog, and then resized it to 40% of the original size. The result? The watermark could be still read, albeit with a lower indicated watermark strength. Likewise, resaving it multiple times as a JPEG just slightly decreases the strength. If you aren't an idiot and don'

Except it doesn't work with resizing. They seem to be assuming that you're editing the picture as-is and saving it again in a JPEG format. I guess it would help make you suspicious of a PNG or some other uncommon format, but they are specifically targeting the JPEG quantizer. It's cool and everything, but that compression mechanism is highly specific to JPEG's. A wavelet compressor or an RLE compressor would completely ignore/miss it.

identification of transcodes is very well-worn technology among MP3 users. Where people will take a 128kbps and transcode it to 320 and cause a small riot when people get upset getting a 320 that sounds like crap.

I imagine this is not really any different. Just look for the telltale squared loss and clipping, but in the image spectrum instead of the audio spectrum.

Actually, that's exactly what you couldn't detect. The VOID only would appear in uniform areas, which means that in addition to all other stated problems with this technique, you can still photoshop Ryan Reynold's head onto a porn star's body as long as you use a magic wand tool and/or a paint bucket on any uniform areas of the image.

If you're really serious about putting Mary Kate and Ashley's head on Lindsay Lohan and Amy Winehouse's bodies, like it says in TFS, you'd use RAW. Then, you can compress everything together. Besides, if you upload that to photo sharing websites (especially Facebook) there's a high chance your picture would be recompressed, so it would have the compression artifacts whether it's been altered or not.

If you're really serious about putting Mary Kate and Ashley's head on Lindsay Lohan and Amy Winehouse's bodies, like it says in TFS, you'd use RAW. Then, you can compress everything together. Besides, if you upload that to photo sharing websites (especially Facebook) there's a high chance your picture would be recompressed, so it would have the compression artifacts whether it's been altered or not.

Fail.

Have access to RAW files of the aforementioned act involving Lindsay and Amy, along with ideally angled shots of the Olsen's faces? Didn't think so. So, you go to google images and start digging. What you find (in the ideal world this paper is picturing (ugh no pun intended)) is that every content creator (from the pr0n guys to the papparazzi that took the olsen's picture) have applied this filter to their work, and as such your efforts are for not. Don't get me wrong, there are tons of problems with this whole idea, but saying "well raw doesnt have artifacts anyway" is a bit of a fail.

Very true. Changing the format to, say, BMP, before doing the shopping, however, has a certain potential. Plus, TFA says this only applies if you change the compression level. So don't change the compression level. (Plus, I suspect it will be about ten minutes before somebody comes up with a Photoshop script that will strip this out, assuming existing watermark removing scripts won't already.)

Yes, the only thing this is useful for, is misleading a Judge into thinking that a digital picture may not be altered. It's past when pictures were able to be used as evidence. It's now really hard to rely on images, but many people would still believe in them.

I brief computer graphics class can show you how easy is to fake pictures. It doesn't matter if you have a "certificate" or some authority to mark the pictures, because that could probably be faked too.

If you're really serious about putting Mary Kate and Ashley's head on Lindsay Lohan and Amy Winehouse's bodies, like it says in TFS, you'd use RAW.

Uh, yeah, by 'use RAW' you mean: "take photos of these celebrities yourself".

...so it would have the compression artifacts whether it's been altered or not.

Unless you took the RAW photos yourself, there would still be different artifacts from each of the pictures you used to do the composite. More artifacts won't change that. Besides that, Facebook resizes the image THEN saves it, again altering the new artifacts in a not-so-subtle way.

You haven't shot this down at all and it's obvious that people with mod points don't understand this topic.

I wonder how long it will take to overcome the "message appears when a particular specific combination of recompression settings is chosen" anti-fraud-or-something technique. I mean, it's such a novel idea and there are so few alternative combinations of recompression settings.

How long before browsers automatically low-pass filter these broken jpegs? If not, then the browser is going to have a hard time resizing the jpeg if this high frequency noise is so large in amplitude that it causes clipping in the jpeg calculations.

I don't think you understand what they mean by clipping in this sense. In JPEG compression, the DCT is performed, the matrix is formed, the coefficients are scaled, quantized(clipped), and then Losslessly compressed. The scaling/clipping(from quantization) IS the core of the low/med quality JPEG compression compression. It is not like "clipping" in the audio sense where it is horribly distorted due to over amplification, the quantization is intentional and in DCT space.

Also, as stated elsewhere on this forum, when a browser resizes a picture, the cache is not recompressed, which is when this intentional dithering becomes apparent.

Consider this: with several different HD sizes in frequent use, and even more computer screen geometries, for any given video you're going to find a lot of legitimate users viewing a radically resized version, so indiscriminate interference is unworkable. So who is this "specific combination" aimed at? YouTube. Could YouTube change their settings to get round this? Yes. Would YouTube change their settings to get round this? No. Because they would then be actively facilitating piracy and in breach of

I wonder how long it will take to overcome the "message appears when a particular specific combination of recompression settings is chosen" anti-fraud-or-something technique.

This is basically what happened when the RIAA tried to impose audio watermarking on CDs; the idea was that if a watermark was destroyed by MP3 compression, the CD player would refuse to play the track. Clearly, this was a stupid idea, since people just played the MP3 file from their computer (did anyone actually think people would spend their time and money burning MP3 files to CD?), and it did not take long before people had Internet connections that could be used to quickly download less compressed (hi

The technique described in the article sounds like it would be defeated by applying a filter to the image before re-compressing it. It sounds like it is very dependent on having the encoder stumble over very specific bits in the image, and messing with those bits is likely to mess up the effect. Worse, if someone goes and finds your message (by encoding the image several times), it seems like it should be pretty easy to reverse the effect.

"New Technique For Making Copy-Evident JPEG Images no longer Copy-Evident"

Seriously, I didnt sit in on the JPEG meetings or anything but it seems like this is a clever idea that could be so very easily circumvented. Recompress the picture, identify the regions exhibiting a "high frequency pattern" (which should be evident) and reverse the frequency of those pixels in the original file prior to recompressing.

But when I take the original and re-save it in Photoshop CS5 I don't see the void lettering. I reduced the JPEG quality and kept trying and at quality 1, the lowest setting I was starting to see a pattern, but no words appeared.

I'd say their idea is nice, but doomed to failure, not least they mention "If you can’t see the message in the recompressed image, make sure your browser is rendering the images without scaling or filtering." which would be the obvious source of attack on such a method should it actually work in practise.

I think the idea is there's some method for taking a munged picture and going, "Watch, I'll run an algorithm and... oh, look, a message with a hole cut in it where your ex-girlfriend's head is sucking that black man's cock..."

Apparently it only works at very specific quality settings. Re-saving with GIMP, I can see the message at quality 24, 38, 41 (barely), 43, 60, 65 (barely), 69 (barely), 72 (barely), and a few others even less.

As far as I can tell (I haven't read the paper), it works by setting up a static hard to compress pattern, and then slightly altering that pattern in certain macroblocks so that they just push the boundary into a different kind of compression artifact at certain quality/quantizer levels. So the entire image is compressed one way at one quality, a different way at another quality, and at the threshold between them there's a quality level where the message blocks compress differently and you can see them.

Also, recompressing has a high chance of destroying the effect permanently. For example, saving at quality 51 destroys the message, and re-compressing at any quality level no longer makes it visible.

I tried it with gimp and it worked. Open the image, save at 60% quality, and the VOID is quite visible. Perhaps it's libjpeg's compression they're relying on. (I assume that's what gimp uses; I haven't actually checked.)

However, the method is easily defeated. Open the image, scale it to twice its size, then scale back down to the original size, and save at 60%. No watermark appears.

I also tried recompressing the test image, and was only able to see the watermark around the 60-65 quality range for JPEG.

However, the goal presented in the paper is to provide a "targeted mark" that will be visible given a predictable recompression scheme. So, if you know a particular photo site (or WAP gateway) recompresses at 60, you can mark the picture to target quality rating of 60.

The paper concludes with "untargeted marks" as a future research opportunity. The authors describe an untargeted mark a

As usual this can be easily defeated by re-sampling or noise filtering. If you're targeting web media and have a high enough resolution source image then you have plenty of redundant pixels to play with to wipe out the watermark.

A better solution for authenticity verification would be digitally signed checksums.

Our algorithm works by adding a high-frequency pattern to the image with an amplitude carefully selected to cause maximum quantization error on recompression at a chosen target JPEG quality factor. The amplitude is modulated with a covert warning message, so that foreground message blocks experience maximum quantization error in the opposite direction to background message blocks. While the message is invisible in the marked original image, it becomes visible due to clipping in a recompressed copy,

My job is image processing, and we are all well aware of the "quirks" of storing images as JPEG. Since it typically uses frequency information, converting to a BMP for a photo editor, and then converting back with some minor modifications introduces all sorts of artifacts into the JPEG coefficients upon recompression. These artifacts can be detected by a program looking for them, and I'm surprised such algorithms are not in use in existing software. And the detection would be able to ignore image resizin

Knowing whether a photo or video has been digitally altered is important for images used as legal evidence. I would not be surprised to see makers of digital cameras and editing software embed a digital signature that can be used to detect alteration. Perhaps with software like Photoshop, it might even record what types of modification were done. There would be little reason to mistrust a photo that was merely rescaled, for example.

Many higher-end cameras do in fact include technology to authenticate original photos. I cannot vouch for how well-implemented they are.

However, all of them are susceptible to the DRM weakness - the guy with the camera has physical possession of everything necessary to generate a faked photo, including the keys. Sure, the keys might be locked up in some chip where they are theoretically difficult to access. However, they are still vulnerable to interception. If you extract the keys then you can make any

How secret can this secret key be, if every camera has to store it I'n order to take "verified" photographs? They tried it with DVD, they tried it with blu-ray, they tried it with the PS3. It just doesn't work like that.

That would only make it hard to alter digital photographs by someone who did not have access to the camera (since the camera must contain the signing key), which doesn't help any in a legal chain-of-custody question. Unless the signing was done by a FIPS140-2 level 4 component, and those are remarkably expensive - but then for a special purpose forensic camera, it would make a lot of sense.

They where not kidding about the specific quality settings. I tried it with the demo image and and The Gimp to reveal the message. I was only able to have it appear only remotely recognizable at 3 of the 101 quality setting

"The days of wondering whether those drunken sex party photos are indeed the Olsen Twins, or if they are just the Mary-Kate and Ashley's faces photo-shopped on the bodies of Lindsay Lohan and Amy Winehouse are OVER!"

You mean that poster next to my Olsen Twin poster is a fake? (Rushes off, and rips a poster off the wall).

Our algorithm works by adding a high-frequency pattern to the image with an amplitude carefully selected to cause maximum quantization error on recompression at a chosen target JPEG quality factor.

The key here is JPEG quality factor. This only works on a specific quality factor. Just pick a different one. I just tried it using their example image. At some quality factors you can see somthing funny going on (spots on image). But, at any factor you would use to actually compress a photo (above 90) the image looks fine.
This could work for the bandwith-saving proxy mentioned in the article since they will have low quality factors. But what would be the point then? Mangling images when viewed on

You know, it's not her fault that her fame-whoring parents pushed her into the kind of child stardom that would leave anyone at least a little warped. It's not her fault that too much fame too fast led to a parade of leeches and "friends" who were all-too-happy to feed her addictions while using her for their own ends. It's not her fault that paparazzi follow her everywhere just waiting for her to make the slightest mistake so they can get a picture of it and make money.

So I opened the original image file in GIMP, went to save it as a JPEG, made sure the preview was turned on, and saw nothing.Of course, this is because I save every jpeg at 1x1, floating point, 100 quality.

No joke, I've noticed a trend where more and more sites have these javascript or some other such crap to display the image. They begin with a insy tinsy image, when you click it shows enlargement but resolution is not great (and of course the right button and various commands are disabled). It is not that I will pirate images but it pains me to no end when I find a fantastic photo of i.e. Gina Lollobrigida (in one her beautiful dresses from "Beautiful But Dangerous" or "Fast and Sexy") and I want to save i

If you know the watermark technique, then you can erase the original watermark and write a new unified watermark.

In fakes (including Tron 2), the main issue is that the lighting is never right.

In reality, the mouse cable is reflecting dark grey light at you. Each key on the keyboard is reflecting a mixture of black and and white at you. The screen is shining orange, green, blue, large masses of white, and grey on you.

If the person next to you has a blue dress, that blue is reflecting off you.

It sounds like it would be relatively easy to detect this willful corruption and counter it... not a 100% inverse transformation, but it should be pretty damn easy to run a mock recompression, make note of the spots where it clips hard, and apply some kind of smoothing. Or, you know, I could smudge your evil pixels into oblivion.

It's an interesting piece of academia, but its reliance on what is effectively a glitch in the common JPEG algorithm means this technique will be trivially neutered by the very peo

At least based on the "VOID" test image they released, I did a bit of analysis and found that the pixels in the word "VOID" were only off by one compared to the rest of the image (whether light or dark pixels). This suggests that this technique (at least in its current form) may be defeated easily (while still recompressing as JPG) if you are willing to quantize each RGB value to either the nearest even or odd value (such that these small variations can be removed). While this reduces the color space quite

Our algorithm works by adding a high-frequency pattern to the image with an amplitude carefully selected to cause maximum quantization error on recompression at a chosen target JPEG quality factor.

So...if I compress it as a TIF, a JPEG-2000, PNG, GIF, or BMP or else run a blur filter, resize, upsample, downsample, any image effects, or cropping 1 pixel off the top row/column (thereby ruining JPEG block alignment) then I can still edit images to my heart's content? Okay...so this is good for catching stupid people?

GIF or BMP would be fine, since they are lossless. Whatever you get on the screen will end up exactly reproduced next time. The drawback is the compression ratio isn't nearly as good, so people tend to use JPEG for photorealistic images, which is why this technique is promoted to work with JPEGs.

Interesting technique, but clearly needs some work (since it only works on certain regions of some images).

Well, one of those palette entries can be transparent, so if you just stack enough GIF images on top of each other...

I've seen something very similar to this done to create a 65536-color GIF. Yes, the GIF palette is limited to 256 colors, but an animated GIF can have a different palette for each frame. With non-overlapping frames or careful use of transparency, you can get a true-color GIF.

Well saving it in a lossless format is always going to be a way around any re-compressing artifacts. No "Print Screen" needed. Just load up the jpg in photoshop, do editing and then save as png.

Image sites that wish to deter fake images could force jpeg encoding, or make a jpeg available, maybe going as far as using something like tineye.com does to help find the original and flag the picture if they differ too much.

I'm sorry man, I accidentally modded your post as troll when trying to mod it as insightful. I'm posting here to remove that moderation.

You're absolutely correct. When you take a screengrab of a JPEG and save it as a JPEG again, you're re-compressing it. It's a bit like playing a 128kbit MP3 from your iPod, hooking it up to your computer via the audio cable, recording it, then compressing it again at 128k. You're going to have accumulated information loss.

Nice try at getting fast karma from a first post, but that's not going to work. The screen shot will already be of the compressed image, and will still show signs of re-compressing it.

Nice try at getting fast karma from a first post correction, but I'm still going to correct you.

Anyone copying an image will have no problems. Copy-evident my ass, the file is 100% the same if I grab it and throw it in a torrent.

As for editing to remove watermarks / logos, the recompression will only show the message if your quality is below a certain threshold.If you edit an image to remove the owner's information, and you see a "THIS IMAGE COPIED FROM SITE.COM" message, just save it at a higher quality.

As even the summary mentions, the technique applies to jpeg-compressed images.

As even the post you replied to mentions, he grabbed a messaged-jpeg via print screen, and recompressed it via jpeg at "60" quality (I'm assuming that's photoshop's "60").

The screenshot provided is in two halves: The top half is the original uncompressed image, and the bottom half is the recomrpessed image. The file format png was chosen for the combined view specifically to avoid compressing the top half and compressing the bottom half a second time.